The increasing popularity of the use of mobile telephones is motivating developers to create mobile applications for information processing, including processing of personal user data. Similar trends are resulting in the functionality of malicious applications being often directed at stealing personal data. Information about purchases, personal contacts, SMS messages, photographs, video clips, documents and the like is personal data and can be stolen and used without the knowledge of the owner.
An antivirus program makes it possible to analyze, terminate and remove malicious applications. However, for a number of reasons, the antivirus program cannot provide complete protection and prevent all instances of stealing of personal data. One example might be a situation when a mobile application which has been verified at the moment by the antivirus program and is not malicious has permission for example to read SMS messages (contacts, mail, photographs, video clips, and so forth). In this case, it is necessary to employ other more effective methods of information protection.
The reading of SMS messages or contacts by an application is not a stealing of personal data, but the processing and transmission of information about contacts may result in stealing of this information. For example, when applications are being installed for the Android® OS, a list of permissions is always displayed, which must be approved in order to install the application. For example, an application may require permissions to be included on the list of recipients of incoming SMS messages. After the user approves listed permissions and the application is then installed, it will receive incoming SMS messages. In one instance, the application may be a modified and improved message manager, which makes it possible to shorten the search time for messages desired by the user. In another instance, the application can search among all incoming messages and utilize for its purposes SMS messages containing a onetime password to perform a financial operation (e.g., the Zeus-in-the-mobile Trojan horse).
Thus, situations arise where there is information that some mobile application might be potentially dangerous, but antivirus software is unable to confirm or deny the actual stealing of personal data by the mobile application.